What is the CVSS score of CVE-2021-34345?

CVE-2021-34345 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.6%.

Ej1600 Firmware CVE-2021-34345

CRITICAL

Out-of-bounds Write (CWE-787)

2021-09-10 security@qnapsecurity.com.tw

Buffer Overflow Qnap RCE Memory Corruption Ej1600 Firmware Tl R1620Sdc Firmware Tl R1620Sep Rp Firmware Tl R1220Sep Rp Firmware Tl D1600S Firmware Tl D800S Firmware Tl D400S Firmware Tl R1200S Rp Firmware Tl R400S Firmware Tl R1200C Rp Firmware Tl D800C Firmware Tr 004 Firmware Tr 002 Firmware Tr 004U Firmware

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Sep 10, 2021 - 04:15 nvd

CRITICAL 9.8

DescriptionNVD

A stack buffer overflow vulnerability has been reported to affect QNAP device running NVR Storage Expansion. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of NVR Storage Expansion: NVR Storage Expansion 1.0.6 ( 2021/08/03 ) and later

AnalysisAI

A stack buffer overflow vulnerability has been reported to affect QNAP device running NVR Storage Expansion. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Out-of-bounds Write (CWE-787), which allows attackers to write data beyond allocated buffer boundaries leading to code execution or crashes. A stack buffer overflow vulnerability has been reported to affect QNAP device running NVR Storage Expansion. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of NVR Storage Expansion: NVR Storage Expansion 1.0.6 ( 2021/08/03 ) and later Affected products include: Qnap Ej1600 Firmware, Qnap Tl-R1620Sdc Firmware, Qnap Tl-R1620Sep-Rp Firmware, Qnap Tl-R1220Sep-Rp Firmware, Qnap Tl-D1600S Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate write boundaries, use memory-safe languages, enable compiler protections (ASLR, stack canaries).